fix: version alignment, SPDX headers, license, integration test glob, and changelog

hyperpolymath · claude · hyperpolymath · commit a9021794366f · 2026-03-20T10:12:01.000Z
- .mcp.json version 0.2.0 → 0.3.0 (was stale after consolidation)
- package.json license MPL-2.0 → PMPL-1.0-or-later (matches project intent)
- SPDX headers added to 13 files (9 adoc, Intentfile, Mustfile, GEMINI.md, cartridge-tools README)
- CHANGELOG.md: add 0.3.0 entry documenting consolidation
- TOPOLOGY.md: add architecture documentation table (9 docs + cartridge tools spec)
- integration.sh: fix glob for ABI detection — was missing nested module dirs
  (nesy-mcp/agent-mcp now pass: 8 passed, 0 failed, 1 skipped)
- Track .gitleaksignore

Co-Authored-By: Claude Opus 4.6 (1M context) &lt;noreply@anthropic.com&gt;
diff --git a/.gitleaksignore b/.gitleaksignore
@@ -0,0 +1,9 @@
+# .gitleaksignore
+# SPDX-License-Identifier: PMPL-1.0-or-later
+
+# Skip known test placeholders in Zig FFI tests
+/var/mnt/eclipse/repos/boj-server/cartridges/cloud-mcp/ffi/cloud_ffi.zig:generic-api-key:1068
+/var/mnt/eclipse/repos/boj-server/cartridges/cloud-mcp/ffi/cloud_ffi.zig:generic-api-key:1095
+/var/mnt/eclipse/repos/boj-server/cartridges/cloud-mcp/ffi/cloud_ffi.zig:generic-api-key:1129
+/var/mnt/eclipse/repos/boj-server/cartridges/cloud-mcp/ffi/cloud_ffi.zig:generic-api-key:1176
+/var/mnt/eclipse/repos/boj-server/cartridges/research-mcp/ffi/research_ffi.zig:generic-api-key:391
diff --git a/.mcp.json b/.mcp.json
@@ -1,6 +1,6 @@
 {
   "name": "boj-server",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps toolkit with 18 domain cartridges",
   "command": "node",
   "args": ["mcp-bridge/main.js"],
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -3,6 +3,30 @@
 
 All notable changes to Bundle of Joy Server are documented here.
 
+## [0.3.0] — 2026-03-20
+
+### Added
+- Consolidated boj-server-mistral and boj-server-gemini into unified repo
+- PanLL ReScript/TEA UI components (BojModel, BojEngine, Boj, BojModule)
+- Gemini CLI extension support (gemini-extension.json, GEMINI.md)
+- 9 architecture docs: Quantum Security, HSM Integration, Cartridge Marketplace,
+  BoJ OS, Formal Verification, Type Safety, Zero Trust, SDP Architecture, Gossip Protocol
+- Cartridge tools specification (Minter, Provisioner, Configurator, Panel Harness)
+- Intentfile and Mustfile (contractile invariant declarations)
+- Farm/fleet enrollment configs
+- EXHIBIT-A (Ethical Use) and EXHIBIT-B (Quantum-Safe Provenance)
+- Hypatia vulnerability-scanning and dependency-update rules
+
+### Fixed
+- Constant-time comparison in webhook HMAC verification (timing attack prevention)
+- .mcp.json version aligned to 0.3.0
+- package.json license corrected to PMPL-1.0-or-later
+- SPDX headers added to all new files
+
+### Removed
+- boj-server-gemini repo (consolidated, deleted from GitHub)
+- boj-server-mistral repo (consolidated, deleted locally)
+
 ## [0.2.0] — 2026-03-09
 
 ### Added
diff --git a/GEMINI.md b/GEMINI.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
 # BoJ Server Gemini Extension
 
 This extension integrates the **Bundle of Joy (BoJ) Server** infrastructure directly into Gemini CLI.
diff --git a/Intentfile b/Intentfile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # BoJ Server Intentfile (Lustfile)
 # Defines the intentions and invariants for AI agents accessing the repository.
 # AI agents must comply with these intentions when interacting with the repo.
diff --git a/Mustfile b/Mustfile
@@ -1,3 +1,4 @@
+# SPDX-License-Identifier: PMPL-1.0-or-later
 # BoJ Server Invariant Classifications
 # This file defines the invariants for the BoJ Server repository.
 # All updates must comply with these invariants.
diff --git a/docs/TOPOLOGY.md b/docs/TOPOLOGY.md
@@ -227,6 +227,21 @@ What is genuinely done:
 - Auto-SDP perimeter (zero-trust, allow-list, auto-ban, 10 tests)
 - 4-continent seed node config (EU-West, EU-Central, US-East, AP-South)
 
+## Architecture Documentation
+
+| Document | Path | Coverage |
+|----------|------|----------|
+| Quantum Security | `docs/architecture/QUANTUM_SECURITY.adoc` | PQC roadmap, hybrid signatures |
+| HSM Integration | `docs/architecture/HSM_INTEGRATION.adoc` | PKCS#11, YubiHSM, CloudHSM |
+| Cartridge Marketplace | `docs/architecture/CARTRIDGE_MARKETPLACE.adoc` | Discovery, quality signals, ratings |
+| BoJ OS | `docs/architecture/BOJ_OS.adoc` | Lightweight node OS (<100MB) |
+| Formal Verification | `docs/architecture/FORMAL_VERIFICATION.adoc` | Idris2/Lean/TLA+ strategy |
+| Type Safety | `docs/architecture/TYPE_SAFETY.adoc` | Cross-language type mappings |
+| Zero Trust | `docs/architecture/ZERO_TRUST.adoc` | SPIFFE/SPIRE, mTLS, OPA |
+| SDP Architecture | `docs/architecture/SDP_ARCHITECTURE.adoc` | QUIC proxy, geo-redundancy |
+| Gossip Protocol | `docs/architecture/GOSSIP_PROTOCOL.adoc` | Umoja gossip protocol details |
+| Cartridge Tools | `docs/specification/cartridge-tools/README.md` | Minter, Provisioner, Configurator, Panel Harness |
+
 Remaining:
 - Deploy seed nodes to actual infrastructure
 - Domain registration for named Cloudflare tunnel
diff --git a/docs/architecture/BOJ_OS.adoc b/docs/architecture/BOJ_OS.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = BoJ OS - Lightweight Operating System for AI Agents
 :toc: preamble
 :icons: font
diff --git a/docs/architecture/CARTRIDGE_MARKETPLACE.adoc b/docs/architecture/CARTRIDGE_MARKETPLACE.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = Cartridge Marketplace Architecture
 :toc: preamble
 :icons: font
diff --git a/docs/architecture/FORMAL_VERIFICATION.adoc b/docs/architecture/FORMAL_VERIFICATION.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = BOJ Server Mistral: Formal Verification Strategy
 :description: Formal verification approach for the complete BOJ + Stapeln + Security stack
 
diff --git a/docs/architecture/GOSSIP_PROTOCOL.adoc b/docs/architecture/GOSSIP_PROTOCOL.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = BOJ Server Mistral: Gossip Protocol Specification
 :description: QUIC-based gossip protocol for node discovery, message passing, and fault tolerance
 
diff --git a/docs/architecture/HSM_INTEGRATION.adoc b/docs/architecture/HSM_INTEGRATION.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = Hardware Security Module (HSM) Integration
 :toc: preamble
 :icons: font
diff --git a/docs/architecture/QUANTUM_SECURITY.adoc b/docs/architecture/QUANTUM_SECURITY.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = Quantum-Resistant Cryptography Architecture
 :toc: preamble
 :icons: font
diff --git a/docs/architecture/SDP_ARCHITECTURE.adoc b/docs/architecture/SDP_ARCHITECTURE.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = BOJ Server Mistral: Secure Data Plane (SDP) Architecture
 :description: SDP implementation for preventing access except via single route
 
diff --git a/docs/architecture/TYPE_SAFETY.adoc b/docs/architecture/TYPE_SAFETY.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = BOJ Server Mistral: Type Safety Across Boundaries
 :description: Type safety guarantees and formal mappings between language boundaries
 
diff --git a/docs/architecture/ZERO_TRUST.adoc b/docs/architecture/ZERO_TRUST.adoc
@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: PMPL-1.0-or-later
 = Zero Trust Architecture for BOJ Server
 :toc: preamble
 :icons: font
diff --git a/docs/specification/cartridge-tools/README.md b/docs/specification/cartridge-tools/README.md
@@ -1,3 +1,4 @@
+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->
 # Cartridge Tools Specification
 
 **Powerful Cartridge Minter, Provisioner, Configurator, and Panel Harness**
diff --git a/package.json b/package.json
@@ -2,7 +2,7 @@
   "name": "@hyperpolymath/boj-server",
   "version": "0.3.0",
   "description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps toolkit with 18 domain cartridges (database, container, git, k8s, observability, secrets, IaC, and more)",
-  "license": "MPL-2.0",
+  "license": "PMPL-1.0-or-later",
   "author": "Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>",
   "repository": {
     "type": "git",
diff --git a/tests/integration.sh b/tests/integration.sh
@@ -118,7 +118,7 @@ echo "Step 7: Matrix verification..."
 cd "$PROJECT_DIR"
 for cart in database-mcp fleet-mcp nesy-mcp agent-mcp; do
     abi_ok=false; ffi_ok=false; adapter_ok=false
-    [ -f "cartridges/$cart/abi"/*/*.idr ] 2>/dev/null && abi_ok=true
+    find "cartridges/$cart/abi" -name '*.idr' 2>/dev/null | grep -q . && abi_ok=true
     [ -f "cartridges/$cart/ffi"/*_ffi.zig ] 2>/dev/null && ffi_ok=true
     [ -f "cartridges/$cart/adapter"/*_adapter.v ] 2>/dev/null && adapter_ok=true
 

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "boj-server",`
`3`		`- "version": "0.2.0",`
	`3`	`+ "version": "0.3.0",`
`4`	`4`	`"description": "Bundle of Joy (BoJ) MCP Server — cartridge-based DevOps toolkit with 18 domain cartridges",`
`5`	`5`	`"command": "node",`
`6`	`6`	`"args": ["mcp-bridge/main.js"],`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+<!-- SPDX-License-Identifier: PMPL-1.0-or-later -->`
`1`	`2`	`# BoJ Server Gemini Extension`
`2`	`3`
`3`	`4`	`This extension integrates the Bundle of Joy (BoJ) Server infrastructure directly into Gemini CLI.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+# SPDX-License-Identifier: PMPL-1.0-or-later`
`1`	`2`	`# BoJ Server Intentfile (Lustfile)`
`2`	`3`	`# Defines the intentions and invariants for AI agents accessing the repository.`
`3`	`4`	`# AI agents must comply with these intentions when interacting with the repo.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+# SPDX-License-Identifier: PMPL-1.0-or-later`
`1`	`2`	`# BoJ Server Invariant Classifications`
`2`	`3`	`# This file defines the invariants for the BoJ Server repository.`
`3`	`4`	`# All updates must comply with these invariants.`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+// SPDX-License-Identifier: PMPL-1.0-or-later`
`1`	`2`	`= BoJ OS - Lightweight Operating System for AI Agents`
`2`	`3`	`:toc: preamble`
`3`	`4`	`:icons: font`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+// SPDX-License-Identifier: PMPL-1.0-or-later`
`1`	`2`	`= Cartridge Marketplace Architecture`
`2`	`3`	`:toc: preamble`
`3`	`4`	`:icons: font`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+// SPDX-License-Identifier: PMPL-1.0-or-later`
`1`	`2`	`= BOJ Server Mistral: Formal Verification Strategy`
`2`	`3`	`:description: Formal verification approach for the complete BOJ + Stapeln + Security stack`
`3`	`4`